AI helped find critical PHP flaws: patch now
Why it matters
PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct 21 to fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2, nicknamed PHP2Shell by Wiz Research) that can allow unauthenticated remote code execution; all users should update immediately. Wiz says PHP powers 70% of websites and every version back to 5.4 is affected by at least one flaw; it demonstrated pre-auth RCE on WordPress, Drupal and Joomla, but the bug is in PHP itself. Calif found a critical flaw with GPT-5.6 Sol through OpenAI's Patch the Planet, and Wiz independently found both using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. PHP 8.1 and older no longer get updates (minimal source backports for 7.4, 8.0 and 8.1).
Read the source: PHP / Wiz Research / OpenAI (opens in a new tab)
All hits from 22 Oct 2026More SecurityGet the daily hits by email